Allow protocols and svg properties to be configurable.

I wanted to allow `data` URIs in images, and in order to do that I had to be able to set `allowed_protocols` and plumb it through to the sanitizer. While I was in there, I made the `allowed_svg_properties` attribute configurable, too.